According to analysis conducted by Kaspersky, over 500 vulnerabilities were discovered in routers in 2021, including 87 critical ones.
Threats stemming from vulnerable routers affect both households and organisations, moving beyond email compromises to physical home security. Despite this, people rarely think about the security of their devices.
According to research, 73% of users have never thought about upgrading or securing their router, making it one of the biggest threats impacting the Internet of Things today.
Here, Kaspersky experts explain what threats router vulnerabilities can pose and how users can protect themselves.
A router is the hub of an entire home network, through which all elements of a smart home access the Internet and exchange data. Infecting a router, attackers gain access to the network through which data packets are transmitted.
Using this, they can install malware on connected computers to steal sensitive data, private photos, or business files – possibly causing irreparable damage to the victim. Through the infected router the attacker can also redirect users to phishing pages masquerading as often-used webmail or online-banking sites.
Any data they enter on these pages, whether it’s their login and password from the email or bank card details, will immediately fall into the hands of fraudsters.
Since 2010, the number of vulnerabilities found in routers has been steadily increasing. In 2020, the number of discovered vulnerabilities increased to 603, about 3 times as many as the year before that. In 2021, the number of discovered vulnerabilities remained almost as high – 506.
Out of all discovered vulnerabilities in 2021, 87 were critical. Critical vulnerabilities are the most unprotected “holes” through which an attacker can penetrate a home or corporate network.
Such vulnerabilities may let the attacker bypass authentication, send remote commands to a router, or even incapacitate it.
Doing so, operators are able to steal any data or files transmitted over an infected network, whether it’s your personal photos, private information, or even business contracts sent in an email.
Though researchers are now raising awareness about many more found vulnerabilities than before, routers remain one of the most insecure devices.
One of the reasons for this is that not all vendors rush to eliminate the dangers.
Almost a third of critical vulnerabilities discovered in 2021 remain without any response from vendors: no patch or commentary with advice has been issued for them.
Another 26% of such vulnerabilities received only a comment from the company, which most often include recommendations to contact technical support.
Alongside attackers’ increased activity, consumers and small businesses don’t have the expertise or resources to identify or understand a threat before it’s too late.
For instance, as mentioned, 73% of users have never thought about upgrading or securing their router, making it one of the biggest threats impacting the Internet of Things today.
This is especially dangerous when routers are used in sensitive environments such as hospitals or government buildings, where a data leak could potentially have a severe impact.
“Despite the speed with which technology is coming into our lives, the level of cybersecurity hasn’t kept pace. Many employees have been working from home for the past two years, but the security of routers hasn’t improved over this time – they’re still rarely updated. Therefore, the risk that router vulnerabilities could be abused by cybercriminals remains a concern in 2022. What’s important is to prevent a threat as early as possible, since people usually find out about an attack when it’s too late – after money has been stolen,” comments Maria Namestnikova, Head of the Russian Global Research and Analysis Team (GReAT) at Kaspersky. “When you buy a router, network security should be as much of a priority as data transfer speed and price. Read reviews and note how quick the manufacturer resolves reported issues. And don’t forget to update your router as soon as the developer releases a patch to avoid losing sensitive data and money,” adds Maria.
Comments 1